Evidence · DiggingBeagle record
JFrog: Brotli2Shell across FFmpeg, ClickHouse, .NET and Arrow decoders
Application-specific Brotli impacts differ by decoder and runtime: crashes, memory corruption and CPU denial of service.
- Source role
- primary disclosure
Evidence record
Application-specific Brotli impacts differ by decoder and runtime: crashes, memory corruption and CPU denial of service.
Claim-level citations (1)
- supportsBrotli Node2Shell: AI-assisted discovery followed by observed exploit attempts: JFrog reports distinct manifestations of the vulnerable Brotli decoder in FFmpeg/JPEG XL, ClickHouse, .NET and Arrow, including crashes and an Arrow high-CPU behavior. These observations do not establish remote code execution in every affected application.
Brotli2Shell technical sections: FFmpeg/JPEG XL, ClickHouse, .NET and Arrow